PromptPrint: Behavioral Biometrics Through Natural Language Prompting in LLMs

# Behavioral Biometrics Through Natural Language Prompting in LLMs
Source: [https://arxiv.org/html/2606.06755](https://arxiv.org/html/2606.06755)
Shaiv Patel Kartik Narayan Vishal Patel Johns Hopkins University, Baltimore, MD, USA \{spate235, knaraya4, vpatel36\}@jh\.edu

###### Abstract

Authorship attribution research has traditionally focused on long\-form, expressive texts; however, interactions with large language models \(LLMs\) are typically brief and task\-driven prompts\. This raises a fundamental question: do such prompts contain a stable, author\-identifiable, and distinctive signal? We introducePromptPrint, a systematic study of prompt\-based identity, the hypothesis that a user’s habitual vocabulary, syntax, and discourse patterns form a learnable behavioral biometric\. Using 20,680 real prompts from 1,034 users, we establish three key findings\. First, lexical representations significantly outperform semantic encoders, supporting the “lexical stability hypothesis”: identity is primarily encoded in surface\-level word choice rather than abstract intent\. Second, stylometric features exhibit a “uniqueness–consistency paradox”: users are highly distinctive across the population, yet behaviorally inconsistent across contexts\. Third, adversarial analysis reveals a clear vulnerability spectrum: identity signals are robust to minor lexical perturbations but degrade substantially under semantic paraphrasing\. Overall, our results demonstrate strong identification performance at scale, establishing prompt\-based identity as a viable behavioral biometric\. This work introduces a new perspective on user modeling in LLM interactions, with important implications for security and privacy\. Data and code will be released upon the acceptance of our work\.

## 1Introduction

Large language models \(LLMs\) have made natural language a central interface for everyday human\-computer interaction through*prompting*\. Each prompt is a deliberate linguistic act in which a user chooses how to articulate an instruction to a machine\. While authorship attribution research has established that writing inherently carries identity\[[28](https://arxiv.org/html/2606.06755#bib.bib2)\], LLM prompts impose extreme linguistic compression and are primarily*instrumental*in nature\-spanning only one to three sentences, stripped of narrative elaboration, and strictly task\-directed\. Traditional authorship attribution assumes sufficient length and expressive intent; prompts routinely violate both\. It remains unclear whether stylometric identity signals persist under these constraints, and which feature spaces best capture them\.

We introducePromptPrint\(Figure[1](https://arxiv.org/html/2606.06755#S1.F1)\) and make four primary contributions:

1. 1\.We formalize*prompt\-based identity*as a novel soft biometric modality and establish the first evaluation protocol for this setting, grounded in standard biometric metrics \(EER,d′d^\{\\prime\}, ROC\-AUC\)\.
2. 2\.We conduct a controlled evaluation of lexical, semantic, and stylometric feature spaces for prompt identification across 1,034 real users using 5\-fold cross\-validation\.
3. 3\.We identify and characterize a*uniqueness\-consistency paradox*within stylometric features where high inter\-user separability paradoxically coexists with low intra\-user consistency and contextualize it through signal detection theory\.
4. 4\.We evaluate the stability of prompt as soft biometric against three adversarial attacks of escalating severity: synonym substitution, homoglyph substitution, and full semantic paraphrase\. We establish that full rewriting severely degrades ensemble identification \(Top\-1=0\.4290\.429, EER=0\.7030\.703\), whereas synonym substitution causes negligible impact \(Δ\\DeltaTop\-1=−\-0\.001\)\. These results indicate that prompt\-based identity signals are concentrated at the token\-surface level and that semantic paraphrasing poses a substantially stronger challenge than minor lexical perturbations\.

Finally, because prompt\-based identity can operate passively and without explicit user awareness, it raises substantial privacy concerns\. We frame this work as identifying a previously uncharacterized surveillance surface and providing a foundation for future defensive research\.

![Refer to caption](https://arxiv.org/html/2606.06755v1/x1.png)Figure 1:LLM prompts as a soft biometric for authentication overview\. A user’s prompt behavior can capture how they think, ask, and express – forming a stable behavioral signature that can be used for authentication\.
## 2Related Work

Authorship Attribution\.Traditional authorship attribution relies on feature spaces ranging from character n\-grams\[[28](https://arxiv.org/html/2606.06755#bib.bib2)\]and function word frequencies\[[15](https://arxiv.org/html/2606.06755#bib.bib3)\]to syntactic patterns\[[22](https://arxiv.org/html/2606.06755#bib.bib4)\]and deep representations\[[8](https://arxiv.org/html/2606.06755#bib.bib5)\]\. A recent comprehensive survey\[[13](https://arxiv.org/html/2606.06755#bib.bib31)\]reviews these methodologies in the context of LLM\-generated text, while Rivera\-Soto et al\.\[[23](https://arxiv.org/html/2606.06755#bib.bib30)\]proposed learning universal authorship representations via contrastive learning for cross\-domain authorship verification\. However, these methodologies are fundamentally predicated on analyzing expressive text such as essays, forum posts, or literary prose of sufficient length\. Behavioral Biometrics\.Behavioral biometrics traditionally isolates persistent identity signals in modalities such as keystroke dynamics\[[19](https://arxiv.org/html/2606.06755#bib.bib29),[24](https://arxiv.org/html/2606.06755#bib.bib28)\], mouse movement\[[1](https://arxiv.org/html/2606.06755#bib.bib27)\], touchscreen interaction\[[11](https://arxiv.org/html/2606.06755#bib.bib26)\], and gait\[[4](https://arxiv.org/html/2606.06755#bib.bib25)\]\. These modalities share a critical property with our framework: they operate*passively*, requiring no explicit enrollment gesture from the user\. We evaluate our findings using standard verification and identification protocols for behavioral biometrics\. However, we extend the broader biometrics paradigm by introducing LLM prompts as a distinctly*linguistic*behavioral channel, establishing a new modality that prior research has yet to explore\. LLM Security and Privacy\.Contemporary research in LLM security predominantly focuses on semantic content, analyzing vulnerabilities through adversarial attacks\[[35](https://arxiv.org/html/2606.06755#bib.bib24)\], prompt injection\[[21](https://arxiv.org/html/2606.06755#bib.bib23)\], and membership inference\[[5](https://arxiv.org/html/2606.06755#bib.bib22)\]\. Concurrently, re\-identification via writing style has been explored in the contexts of de\-anonymization\[[20](https://arxiv.org/html/2606.06755#bib.bib21)\]and browser fingerprinting\[[7](https://arxiv.org/html/2606.06755#bib.bib35)\]\. Moreover, Staab et al\.\[[27](https://arxiv.org/html/2606.06755#bib.bib20)\]demonstrated that LLMs can infer personal attributes from user text at scale, highlighting inference\-based privacy risksbeyond training data memorization\. Our framework bridges these domains: we isolate stable stylistic behavior in prompts as a persistent identity channel, operating independently of the semantic intent or payload of the query\. Prompting as a Distinct Behavioral Signal\.To our knowledge, no prior work investigates prompting behavior as a measurable behavioral biometric\. The most adjacent line of research applies stylometric analysis to short social media texts for authorship verification\[[30](https://arxiv.org/html/2606.06755#bib.bib19)\],\[[32](https://arxiv.org/html/2606.06755#bib.bib18)\]\. However, social media content remains fundamentally expressive and self\-initiated\. Prompts, conversely, are reactive, task\-directed constraints\.

## 3Dataset

We utilize WildChat\-1M\[[34](https://arxiv.org/html/2606.06755#bib.bib1)\], a public corpus comprising over one million authentic ChatGPT conversations collected via a proxy interface, with users distinguished by SHA\-256 hashed IP addresses \(hashed\_ip\)\. These interactions were captured in the wild without users’ awareness of subsequent analysis, so the dataset preserves genuine prompting habits and avoids the behavioral artificiality inherent to laboratory\-constrained datasets\. The corpus is publicly released under an open license\.

### 3\.1Extraction Protocol

To isolate the user’s baseline identity signal, we extract only the first user turn from each conversation: the initial, autonomous instruction provided prior to any LLM\-guided follow\-up\. This methodological constraint is vital for assessing behavioral stability, as users in multi\-turn dialogues frequently exhibit linguistic accommodation by subconsciously mirroring the model’s vocabulary and structural register\. Such adaptation would contaminate the underlying stylometric fingerprint\. We subsequently apply four quality filters to the isolated prompts:

- •Language: English only \(language == ‘English’\)
- •*Minimum length:*≥\\geq10 characters
- •*Maximum length:*≤\\leq2,000 characters
- •*Content:*Exclusion of URL\-only and code\-block\-only prompts

Users with fewer than 20 qualifying prompts are excluded\. Retained users are ranked by total prompt count, and the top 1,500 are evaluated; exactly 1,034 users meet the strict 20\-prompt threshold with complete qualification\.

### 3\.2Statistics

The final evaluation dataset comprises 20,680 prompts distributed uniformly across 1,034 users, with 20 prompts per user\. The prompt length distribution: mean 187 characters, standard deviation 312, and median 98 characters, quantitatively reflects the highly compressed, task\-directed nature of real\-world prompting behavior\. Sample prompts from the WildChat\-1M dataset are shown in Figure[2](https://arxiv.org/html/2606.06755#S3.F2)\.

![Refer to caption](https://arxiv.org/html/2606.06755v1/x2.png)Figure 2:Samples prompts from the WildChat\-1M dataset\.
### 3\.3Ethical Compliance

WildChat\-1M is explicitly released for research applications\. All user identities are cryptographically hashed at the source, ensuring no personally identifiable information \(PII\) is retained or processed\. As this study involves retrospective analysis of anonymized public data without direct human subject interaction, it is exempt from institutional review board \(IRB\) approval under standard guidelines\. We note that WildChat\-1M’s hashed IP\-based user proxies are a dataset\-level constraint, not a methodological choice\. Label noise from shared and dynamic IPs makes identification strictly harder, so our metrics represent a conservative lower bound on true performance; datasets with verified user identities would yield stronger signal detection\. We address the broader ethical implications of establishing prompt as a soft biometric channel in Section[6](https://arxiv.org/html/2606.06755#S6)\.

## 4PromptPrint: Modeling and Inference

The PromptPrint behavioral embedding𝐳=\[z1,z2,…,zd\]\\mathbf\{z\}=\[z\_\{1\},z\_\{2\},\\ldots,z\_\{d\}\]denotes the feature vector extracted from a user’s prompt under a given representation space \(lexical, semantic, or stylometric\), used to construct per\-user prototype vectors for identification and verification\.

### 4\.1Features

Given user prompts, we investigate three distinct feature representations to identify which signals reliably capture stable behavioral identity\.

Lexical \(TF\-IDF\) Features\.We extract bag\-of\-words representations using unigrams and bigrams, with sublinear term\-frequency scaling \(log⁡\(1\+tf\)\\log\(1\+\\mathrm\{tf\}\)\), wheretf\\mathrm\{tf\}denotes the raw term frequency and the logarithmic transform attenuates the influence of high\-frequency terms\. Features are constrained by a minimum document frequency of 2 and a vocabulary capped at 30,000 features\[[25](https://arxiv.org/html/2606.06755#bib.bib33)\]\. This space isolates the specific vocabulary and phrasal habits unique to a user’s generative behavior\. Semantic \(SBERT\) Features\.We utilize 768\-dimensional, L2\-normalized sentence embeddings derived fromintfloat/e5\-base\[[31](https://arxiv.org/html/2606.06755#bib.bib36)\]\. E5 is trained via contrastive learning on large\-scale text pairs for general\-purpose dense retrieval\. This space encodes the overarching semantic intent of prompts, independent of specific surface phrasing\. We selecte5\-baseas it demonstrated stable performance across preliminary encoder comparisons, and its computational footprint is compatible with 5\-fold cross\-validation at scale; larger encoders would likely strengthen the semantic baseline but would not alter the core finding that lexical representations fundamentally outperform semantic encoders for this task\. Stylometric Features\.Following established authorship attribution conventions\[[28](https://arxiv.org/html/2606.06755#bib.bib2)\], we extract ten hand\-crafted features: average word length, vocabulary richness \(type\-token ratio\), punctuation ratio, stopword ratio, noun/verb/adjective ratios \(via Penn Treebank POS tags using NLTK\[[3](https://arxiv.org/html/2606.06755#bib.bib17)\]\), average sentence length, uppercase ratio, and digit ratio\. This quantifies surface\-level writing patterns strictly independent of semantic content\.

### 4\.2Models and Classifiers

We train six systems for comparative evaluation\. All training and benchmarking were performed on NVIDIA A100 Tensor Core GPUs\.

\(TF\-IDF\)\+LR\.A TF\-IDF vectorizer is paired with a multinomial Logistic Regression classifier using the L\-BFGS solver,C=1\.0C=1\.0, and balanced class weights\.

SBERT\-NN\.A frozen SBERT encoder \(768\-d\) feeding a three\-layer MLP\. The architecture comprises of an input projection \(768→\\to384\), a residual block \(384→\\to384\), compression layers \(384→\\to192→\\to96\), and a final classification head \(96→\\toN\)\. The encoder remains strictly frozen to prevent catastrophic forgetting\[[18](https://arxiv.org/html/2606.06755#bib.bib16)\]on the constrained per\-user training sets\. Training utilizes label\-smoothed cross\-entropy \(ε\\varepsilon=0\.1\), the AdamW optimizer\[[16](https://arxiv.org/html/2606.06755#bib.bib15)\]\(η\\eta=1e\-4, weight decay=0\.01\), a cosine annealing learning rate schedule, and early stopping \(patience=10\)\.

Stylo\-NN\.This utilizes an identical MLP architecture, with the input projection adapted to10→38410\\to 384to process the 10\-dimensional stylometric feature vector, exclusively isolating surface\-level structural habits\.

Combined\-NN\.SBERT and stylometric features are concatenated \(778\-d\) prior to feeding the standard MLP, directly testing feature\-level fusion capabilities\.

Ensemble\.A score\-level fusion mechanism defined as:

Pens=α⋅PSBERT\+\(1−α\)⋅PTF\-IDFP\_\{\\text\{ens\}\}=\\alpha\\cdot P\_\{\\text\{SBERT\}\}\+\(1\-\\alpha\)\\cdot P\_\{\\text\{TF\-IDF\}\}\(1\)wherePSBERTP\_\{\\text\{SBERT\}\}andPTF\-IDFP\_\{\\text\{TF\-IDF\}\}are the class probability distributions produced by each component,PensP\_\{\\text\{ens\}\}is the fused output distribution, andα∈\{0\.0,0\.1,…,1\.0\}\\alpha\\in\\\{0\.0,0\.1,\\ldots,1\.0\\\}is the interpolation weight swept to identify the optimal fusion ratio\.

CharNgram\+SVM\.Characternn\-gram features \(2–5\)\[[28](https://arxiv.org/html/2606.06755#bib.bib2)\]coupled with LinearSVC\[[9](https://arxiv.org/html/2606.06755#bib.bib34)\], serving as the standard authorship attribution baseline\.

### 4\.3Evaluation Protocol

Data splits\.We employ 5\-fold cross\-validation\. In each fold, the population is partitioned into seen users \(80%,≈\\approx828 users\) and unseen users \(20%,≈\\approx206 users\)\. Seen users contribute 16 training, 2 validation, and 2 test prompts each\. Unseen users constitute the strict impostor set for the verification evaluation\. All splits are computationally validated to guarantee zero user overlap between seen and unseen cohorts\.

Identification metrics\.We evaluate closed\-set Top\-k accuracy over seen users reporting Top\-1, Top\-3, and Top\-5 accuracy\. Closed\-set evaluation assumes that the query user necessarily exists within the gallery; therefore, we also address open\-set identification, where the system must determine whether a query belongs to the gallery at all, using the verification metrics detailed below\.

Verification metrics\.Genuine scores are calculated as the cosine similarities between test embeddings and per\-user prototype vectors \(the mean train embedding\)\. Impostor scores represent the maximum cosine similarities of unseen\-user embeddings against the gallery\. Open\-set performance is quantified using the Equal Error Rate \(EER\), defined as the threshold at which the false\-accept rate equals the false\-reject rate\. We report ROC\-AUC, EER, and the sensitivity indexd′d^\{\\prime\}:

d′=\|μg−μi\|12​\(σg2\+σi2\),d^\{\\prime\}=\\frac\{\|\\mu\_\{g\}\-\\mu\_\{i\}\|\}\{\\sqrt\{\\tfrac\{1\}\{2\}\(\\sigma\_\{g\}^\{2\}\+\\sigma\_\{i\}^\{2\}\)\}\},\(2\)whereμg,σg\\mu\_\{g\},\\sigma\_\{g\}denote the mean and standard deviation of genuine scores, andμi,σi\\mu\_\{i\},\\sigma\_\{i\}denote those of the impostor scores\. Verification metrics are computed uniformly across all methods via cosine similarity between test embeddings and per\-user prototype vectors \(mean train embeddings\), with EER and AUC derived from the resulting genuine and impostor score distributions\. For SBERT\-based models, raw768−d768\-dencoder embeddings are used directly; for \(TF\-IDF\)\+LR, the sparse TF\-IDF vectors serve as the embedding space\. Identification metrics utilize the final classification layer predictions across all methods\.

### 4\.4Adversarial Protocol

To assess the biometric stability of prompt\-based identity, we evaluate three threat models\. The first two attacks are applied at varying perturbation ratesr∈\{5%,10%,20%,30%\}r\\in\\\{5\\%,10\\%,20\\%,30\\%\\\}, while the third executes a complete rewrite: Homoglyph attack\.Latin characters are replaced with visually identical Unicode homoglyphs \(e\.g\., Latin ‘a’→\\toCyrillic ‘a’, Latin ‘e’→\\toCyrillic ‘e’\)\. This mechanism disrupts token recognition without altering the visual appearance of the text, forcing the tokenizer to produce out\-of\-vocabulary or fragmented subword units for targeted tokens\. Synonym attack\.Adjectives and adverbs are substituted with WordNet\[[10](https://arxiv.org/html/2606.06755#bib.bib14)\]synonyms \(selected randomly from first\-sense synset lemmas\)\. This attack preserves the token\-level surface form while scrambling modifier\-level choices\. Content words \(nouns, verbs\) and structural function words are strictly preserved to isolate and test the modifier\-level identity signal\. Paraphrase attack\.The entire prompt is regenerated utilizing a neural paraphrase model \(tuner007/pegasus\_paraphrase\[[33](https://arxiv.org/html/2606.06755#bib.bib13)\]\)\. This preserves the core semantic intent while aggressively over\-writing the user’s surface vocabulary, phrasal structures, and idiosyncratic habits\. As a full\-surface attack, no original token is guaranteed to survive\. This is applied uniformly \(rate=100%\) to benchmark the channel’s vulnerability to maximum\-effort surface erasure\.

## 5Experimental Results

### 5\.1Main Results

Table[1](https://arxiv.org/html/2606.06755#S5.T1)reports 5\-fold cross\-validation results across all methods\. All approaches substantially exceed the random baseline \(Top\-1=0\.097% for 1,034 users\)

Table 1:Main Results\.5\-fold cross\-validation results corresponding to 1,034 users\. Best identification result inbold; best verification result initalic\.↑\\uparrowhigher is better,↓\\downarrowlower is better\. Random chance Top\-1=0\.097%=0\.097\\%\. TAR derived via ROC interpolation per ISO/IEC 19795\.Finding 1 \- Lexical properties dominate semantic intent\.\(TF\-IDF\)\+LR outperforms SBERT\-NN across all verification metrics despite utilizing no contextual reasoning \(d′d^\{\\prime\}=0\.671 vs\. 0\.159, EER=0\.381 vs\. 0\.463\)\. This robustly supports the*Lexical Stability Hypothesis*: sentence encoders optimized for semantic similarity\[[31](https://arxiv.org/html/2606.06755#bib.bib36)\]actively collapse semantically equivalent phrasings thereby destroying the identity signal while TF\-IDF preserves the specific, idiosyncratic token choices that define a user’s habitual behavior\. This finding aligns with Wegmann et al\.\[[32](https://arxiv.org/html/2606.06755#bib.bib18)\], who demonstrated that standard text embeddings conflate topical similarity with authorial style, and with Tyo et al\.\[[30](https://arxiv.org/html/2606.06755#bib.bib19)\], who independently found that traditional n\-gram models outperform neural approaches on the majority of authorship attribution benchmarks\. Paraphrase invariance is an intentional inductive bias for semantic search, but it proves fundamentally misaligned for biometric identification\.

Notably, while the ensemble achieves the highest identification accuracy \(Top\-1=64\.2%\), \(TF\-IDF\)\+LR retains the best verification performance \(EER=0\.381 vs\. 0\.421,p<0\.001p\{<\}0\.001, pairedtt\-test\), confirming thatα=0\.7\\alpha\{=\}0\.7optimises for rank\-based retrieval rather than verification threshold calibration; this trade\-off is analyzed in Section[5\.3](https://arxiv.org/html/2606.06755#S5.SS3)\.

Finding 2 \- Instrumental text requires a distinct biometric paradigm\.While CharNgram\+SVM serves as the standard short\-text baseline for authorship attribution\[[28](https://arxiv.org/html/2606.06755#bib.bib2)\], our prompt\-specific ensemble demonstrates a clear behavioral divergence, identifying users with 64\.2% accuracy compared to the baseline’s 54\.2%\. This 10\-point delta empirically confirms that the highly compressed, task\-directed nature of prompting cannot be fully captured by legacy expressive\-text models; it requires feature spaces explicitly tuned to instrumental linguistic habits\.

Finding 3 \- Feature\-level fusion degrades component efficacy\.Combined\-NN \(d′=0\.096d^\{\\prime\}=0\.096\) yields weaker separation than both SBERT\-NN \(d′=0\.159d^\{\\prime\}=0\.159\) and Stylo\-NN \(d′=0\.950d^\{\\prime\}=0\.950\) in isolation\. The ten stylometric features comprise merely 1\.3% of the 778\-dimensional joint vector; therefore, the MLP classifier lacks a structural mechanism to up\-weight this low\-dimensional signal against the high\-variance 768\-dimensional SBERT embeddings\. Score\-level fusion through the Ensemble model effectively circumvents this bottleneck by preserving the independent discriminative power of each modality\.

![Refer to caption](https://arxiv.org/html/2606.06755v1/x3.png)

![Refer to caption](https://arxiv.org/html/2606.06755v1/x4.png)

![Refer to caption](https://arxiv.org/html/2606.06755v1/x5.png)

Figure 3:Left:Uniqueness\-consistency trade\-off\. Each point represents one method \(mean±\\pmstd, 5 folds\)\. Stylo\-NN \(red\) isolates the paradox: highestd′d^\{\\prime\}yet lowest Top\-1\. TF\-IDF\+LR \(orange\) achieves optimal verification \(d′d^\{\\prime\}=0\.671\); Ensemble \(blue\) achieves optimal identification \(Top\-1=64\.2%\)\.Middle:Top\-1/3/5 accuracy vs\. ensemble weightα\\alpha\. Plateau betweenα=0\.5\\alpha\{=\}0\.5–0\.90\.9confirms stability; standardized atα=0\.7\\alpha\{=\}0\.7\.Right:Top\-1 accuracy vs\. cohort size \(log scale\)\. Labels indicate performance factor above chance\. TF\-IDF consistently outperforms SBERT across all cohort sizes\.
### 5\.2The Stylometry Paradox

The*Stylometry Paradox*refers to the observation that users exhibit distinctive writing styles across a population, yet their style lacks sufficient consistency across contexts for reliable identification\. We examine this paradox in the setting of LLM prompts and analyze its implications for prompt\-based identity\. Stylo\-NN produces the highest distributional separation \(d′d^\{\\prime\}=0\.950±\\pm0\.022\) while simultaneously yielding the lowest identification accuracy \(Top\-1=24\.9±\\pm0\.9%\)\. This divergence is resolved through signal detection theory:d′d^\{\\prime\}measures the distributional separation between genuine and impostor score populations, whereas Top\-1 measures instance\-level ranking consistency\.

Users demonstrate*inter\-personal distinctiveness*in surface style \(highd′d^\{\\prime\}\), yet remain*intra\-personally inconsistent*\. A user’s stylometric profile shifts fluidly with topic, prompt length, and cognitive load\[[2](https://arxiv.org/html/2606.06755#bib.bib12)\]\. For example, a user issuing a coding request generates shorter, highly imperative sentences with a higher digit ratio compared to their own factual queries\. In aggregate, their distribution remains distinct from other users \(highd′d^\{\\prime\}\); however, no single isolated prompt reliably maps back to the user’s prototype \(low Top\-1\)\. Consequently, stylometric features are structurally inadequate as a standalone identification modality for prompts, but provide highly valuable distributional signal when utilized in soft\-score verification fusion\.

### 5\.3Alpha Sweep and Fusion Analysis

Figure[3](https://arxiv.org/html/2606.06755#S5.F3)\(middle\) illustrates Top\-1 accuracy as a function of the ensemble weightα\\alpha\(Equation[1](https://arxiv.org/html/2606.06755#S4.E1)\), evaluated on a held\-out fold\. Atα=0\.0\\alpha\{=\}0\.0\(pure TF\-IDF\), Top\-1=0\.621=0\.621; atα=1\.0\\alpha\{=\}1\.0\(pure SBERT\), Top\-1=0\.520=0\.520\. The performance curve peaks atα=0\.9\\alpha\{=\}0\.9\(Top\-1=0\.646=0\.646\), with our primary ensemble fixed atα=0\.7\\alpha\{=\}0\.7\(Top\-1=0\.642=0\.642\) a negligible variance confirming robust stability across the range\[0\.5,0\.9\]\[0\.5,0\.9\]\. The extended flat region indicates that SBERT functions as a stable marginal complement to TF\-IDF rather than providing an independent discriminative axis\. Crucially, while the ensemble improves identification over standalone TF\-IDF \(64\.2% vs\. 63\.0%\), it incurs a verification penalty \(EER=0\.421 vs\. 0\.381\)\. This stems from the architecture: score\-level fusion synthesizes complementary probability rankings \(boosting identification\), whereas verification relies on the strict geometric separation of the embedding space\. TF\-IDF naturally achieves this separation: its sparse, high\-dimensional token vectors generate distinct genuine and impostor distributions \(d′=0\.671d^\{\\prime\}=0\.671\)\. Integrating SBERT’s cosine scores, which possess a weaker geometric boundary \(d′d^\{\\prime\}=0\.159\), dilutes the spatial separation\. Thus, score\-level fusion is optimized for identification; maximizing verification requires a jointly trained metric\-space model, a direction we reserve for future work \(Section[6](https://arxiv.org/html/2606.06755#S6)\)\.

Table 2:Scalability×\\timesEnrollment\.Top\-1 accuracy across cohort size and enrollment countNN\.Bold==best between TF\-IDF and SBERT per cell\. Chance:1\.0%1\.0\\%\(100 users\)→\\to0\.097%0\.097\\%\(1,034 users\)\.N=10N\{=\}10is the stabilisation threshold\.
### 5\.4Scalability

Table[2](https://arxiv.org/html/2606.06755#S5.T2)and Figure[3](https://arxiv.org/html/2606.06755#S5.F3)\(right\) report system performance across gallery sizes ranging from 100 to 1,034 users\. As expected, Top\-1 accuracy decreases monotonically with gallery size across all feature spaces\. This degradation is a well\-documented phenomenon in both authorship attribution\[[17](https://arxiv.org/html/2606.06755#bib.bib11),[29](https://arxiv.org/html/2606.06755#bib.bib10)\]and soft biometric identification\[[6](https://arxiv.org/html/2606.06755#bib.bib9)\], where inter\-class confusability grows as the candidate pool expands and random chance itself falls as1/N1/N\. Luyckx and Daelemans\[[17](https://arxiv.org/html/2606.06755#bib.bib11)\]systematically demonstrated this effect for stylometric classifiers, showing steep accuracy declines as author sets scale beyond small laboratory sizes\.

Despite a10\.3×10\.3\\timesincrease in gallery size, the absolute Top\-1 accuracy drop for TF\-IDF is 14\.6 percentage points \(76\.9%76\.9\\%to62\.3%62\.3\\%atN=20N\{=\}20\), indicating that the lexical signal retains discriminative value at scale\. The ensemble outperforms standalone TF\-IDF by 2\-4 percentage points across all cohort sizes, a margin that remains approximately stable rather than diverging or collapsing; however, this modest gap should be interpreted alongside the verification trade\-off discussed in Section[5\.3](https://arxiv.org/html/2606.06755#S5.SS3)\.

### 5\.5Enrollment Requirements and Feature\-Space Crossover

Table[2](https://arxiv.org/html/2606.06755#S5.T2)tracks Top\-1 accuracy for TF\-IDF\+LR, SBERT\+LR \(frozen encoder\), and Stylo\+LR across a full matrix of deployment scales and user enrollment counts\. All pipelines utilize LogisticRegression for direct comparative validity\.

Enrollment Stabilization\.N=10 represents a universal stabilization threshold\. The performance delta from N=5→\\toN=10 remains consistent across all scales and feature spaces:\+\+11\.9\-19\.2pp for TF\-IDF,\+\+11\.4\-13\.8pp for SBERT, and\+\+4\.6\-11\.9pp for Stylo\. Beyond 10 prompts, marginal gains diminish sharply, establishing it as the practical minimum for deployment\.

Representation Crossover\.In small deployments with sparse enrollment \(≤\\leq300 users, N=5\), SBERT outpaces or ties TF\-IDF \(e\.g\., 0\.467 vs\. 0\.442 at 300 users, N=5\)\. However, at larger scales \(≥\\geq300 users, N≥\\geq10\), TF\-IDF fundamentally dominates\. This crossover validates the mechanics of the score\-level ensemble: SBERT provides critical fallback signals when a user’s lexical map is too sparse, while TF\-IDF drives accuracy once the vocabulary fingerprint reaches critical mass\.

Stylometric Variance\.In direct contradiction to standard assumptions, Stylo\+LR requires volume to function; it improves dramatically from 0\.200 to 0\.412 \(100 users\) and 0\.100 to 0\.177 \(1,034 users\) as N scales from 5 to 20\. A single prompt lacks the linguistic surface area to reliably estimate part\-of\-speech ratios or vocabulary richness\.

### 5\.6TF\-IDF Vocabulary Size Ablation

To isolate the efficiency of the primary lexical component, we mapped vocabulary size constraints \(max\_features\) across\{\\\{5K, 10K, 20K, 30K, 50K, 100K\}\\\}on a held\-out fold \(Table[3](https://arxiv.org/html/2606.06755#S5.T3)\)\. While accuracy scales monotonically, the inflection points dictate deployment feasibility\. The most significant leap occurs between 5K→\\to20K \(\+5\.1pp\), plateauing slightly at the 20K→\\to30K boundary \(\+0\.4pp\)\. Expanding to 100K yields an additional 3\.2pp, but demands a 3\.3×\\timesincrease in feature dimensionality and 3×\\timeslonger training cycles\. The 30K parameter establishes an optimal efficiency threshold, capturing the discriminative core of user habits while filtering out high\-noise, long\-tail tokens\.

Table 3:TF\-IDF Feature Count Ablation\.Effect ofmax\_featureson Top\-kkaccuracy and training time \(single fold, 1,034 users,N=10N\{=\}10\)\.∗= baseline used in primary experiments\.max\_feat\.Top\-1↑\\uparrowTop\-3↑\\uparrowTop\-5↑\\uparrowTime \(s\)5,0000\.5720\.6810\.7187\.110,0000\.6010\.7080\.74212\.320,0000\.6230\.7230\.75618\.430,000∗0\.6270\.7300\.76522\.350,0000\.6450\.7450\.77533\.1100,0000\.6590\.7570\.78494\.7
### 5\.7Adversarial Robustness

Evaluation Protocol\.To rigorously test the stability of the biometric signature, adversarial transformations were applied to held\-out test prompts and processed through the full TF\-IDF\+SBERT ensemble \(α\\alpha=0\.7\)\. Evaluating the full pipeline ensures the attacker must bypass the complete multi\-modal defense rather than an isolated semantic vector\.

As illustrated in Figure 4 and detailed in Table[4](https://arxiv.org/html/2606.06755#S5.T4), the hierarchical severity of these attacks provides critical mechanistic insight into the identity signal\. Synonym substitution \(20%\) fails to disrupt the fingerprint \(Top\-1=0\.641,Δ\\Delta=−\-0\.001\); because core nouns, verbs, and structural phrasing remain intact, TF\-IDF absorbs the minor adjective permutations seamlessly\. Homoglyph injection \(20%\) causes measurable degradation \(Top\-1=0\.588,Δ=−0\.054\\Delta\{=\}\{\-\}0\.054\), as the corrupted subword tokenization bypasses SBERT’s semantic mapping, though TF\-IDF retains partial resilience via adjacent bigram boundaries\.

However, full semantic paraphrase triggers a catastrophic systemic failure\. Erasing the original lexical surface drives Top\-1 accuracy down to 0\.429 \(Δ\\Delta=−\-0\.213\) and spikes the EER to 0\.703\. When forced to analyze structurally novel text with an identical semantic payload, the ensemble collapses\. This conclusively validates the Lexical Stability Hypothesis:*the biometric fingerprint resides exclusively in the surface syntax, and vanishes entirely when semantically equivalent rephrasing occurs*\.

Table 4:Adversarial Robustness — Full Rate Sweep\(5\-fold, mean±\\pmstd\)\. All attacks applied to Ensemble \(α=0\.7\\alpha\{=\}0\.7\)\.Δ\\DeltaTop\-1 andΔ\\DeltaEER relative to unattacked baseline \(rate=0%=0\\%\)\. Paraphrase is a full surface rewrite \(rate=100%=100\\%\)\.AttackRateTop\-1↑\\uparrowTop\-3↑\\uparrowTop\-5↑\\uparrowAUC↑\\uparrowEER↓\\downarrowd′Δ\\DeltaTop\-1Δ\\DeltaEERNone \(baseline\)—0\.642±\\pm0\.0040\.755±\\pm0\.0040\.793±\\pm0\.0050\.603±\\pm0\.0050\.421±\\pm0\.0050\.471±\\pm0\.009——Synonym5%0\.641±\\pm0\.0040\.755±\\pm0\.0040\.793±\\pm0\.0050\.603±\\pm0\.0050\.421±\\pm0\.0050\.471±\\pm0\.009−\-0\.0010\.00010%0\.642±\\pm0\.0040\.756±\\pm0\.0040\.793±\\pm0\.0050\.603±\\pm0\.0050\.421±\\pm0\.0050\.469±\\pm0\.0090\.0000\.00020%0\.641±\\pm0\.0030\.755±\\pm0\.0030\.793±\\pm0\.0050\.603±\\pm0\.0050\.422±\\pm0\.0060\.465±\\pm0\.009−\-0\.001\+\+0\.00130%0\.641±\\pm0\.0040\.755±\\pm0\.0040\.793±\\pm0\.0050\.603±\\pm0\.0050\.422±\\pm0\.0050\.462±\\pm0\.010−\-0\.001\+\+0\.001Homoglyph5%0\.635±\\pm0\.0010\.752±\\pm0\.0050\.789±\\pm0\.0060\.620±\\pm0\.0040\.408±\\pm0\.0030\.490±\\pm0\.007−\-0\.007−\-0\.01310%0\.622±\\pm0\.0050\.739±\\pm0\.0030\.779±\\pm0\.0060\.628±\\pm0\.0040\.403±\\pm0\.0040\.503±\\pm0\.007−\-0\.020−\-0\.01820%0\.588±\\pm0\.0040\.708±\\pm0\.0080\.750±\\pm0\.0080\.621±\\pm0\.0030\.409±\\pm0\.0050\.438±\\pm0\.007−\-0\.054−\-0\.01230%0\.564±\\pm0\.0040\.680±\\pm0\.0050\.720±\\pm0\.0050\.596±\\pm0\.0080\.423±\\pm0\.0090\.313±\\pm0\.015−\-0\.078\+\+0\.002Paraphrase100%0\.429±\\pm0\.0050\.553±\\pm0\.0060\.606±\\pm0\.0060\.236±\\pm0\.0050\.703±\\pm0\.0030\.967±\\pm0\.025−\-0\.213\+\+0\.282

![Refer to caption](https://arxiv.org/html/2606.06755v1/x6.png)Figure 4:Adversarial robustness modeling\.Left:Top\-1 accuracy vs\. token substitution rates\.Right:Impact of complete threat vectors against the unattacked Ensemble baseline \(0\.642\)\. Full paraphrase executes the most severe degradation \(Top\-1=0\.429, EER=0\.703\), proving the fingerprint is bound to the lexical surface rather than semantic intent\.

## 6Discussion

### 6\.1Prompt Idiolect

Prompt idiolect refers to the consistent, user\-specific patterns embedded in prompt construction spanning lexical choice, syntactic structure, and interaction style that persist across tasks and can serve as a basis for behavioral identification\. Our findings collectively support a unifying perspective:*prompt identity is fundamentally a lexical\-surface biometric*\. Specifically, we observe:

- •Lexically encoded:TF\-IDF \(d′d^\{\\prime\}=0\.671\) severely outperforms SBERT \(d′d^\{\\prime\}=0\.159\)\.
- •Token\-surface dependent:Full semantic paraphrase induces catastrophic degradation \(ensemble Top\-1=0\.429\), whereas synonym substitution \(20%\) causes negligible impact \(Top\-1=0\.641\)\.
- •Inter\-personally distinctive:Stylometric features yield high distributional separation \(Stylo\-NNd′d^\{\\prime\}=0\.950\)\.
- •Intra\-personally inconsistent:Stylometric features simultaneously fail at instance\-level ranking \(Stylo\-NN Top\-1=24\.9%\)\.
- •Resistant to semantic integration:Feature\-level fusion with SBERT \(d′d^\{\\prime\}=0\.097\) performs worse than either modality in isolation\.

### 6\.2Biometric Baseline Calibration

PromptPrint is a foundational discovery study characterizing the existence, location, and adversarial robustness of a novel soft biometric signal i\.e\. prompting behavior\. An EER of 0\.381 \(TF\-IDF standalone\), achieved using only 20 prompts, no dedicated enrollment procedure, and noisy IP\-based identity labels, establishes a meaningful preliminary signal for a previously unstudied modality\. As a passive, enrollment\-free channel operating on unconstrained in\-the\-wild text, PromptPrint is most appropriately contextualized within the soft biometrics paradigm\[[6](https://arxiv.org/html/2606.06755#bib.bib9)\], where modalities such as gait\[[26](https://arxiv.org/html/2606.06755#bib.bib8)\]and writing style\[[12](https://arxiv.org/html/2606.06755#bib.bib7)\]report EERs in the 0\.15\-0\.35 range under mature, controlled conditions\. Our baseline of 0\.381, achieved without any dedicated enrollment protocol and under noisy label conditions, is consistent with early\-stage discovery results in comparable soft biometric modalities\. Transitioning this signal to a deployment\-ready system would necessitate dedicated metric\-learning objectives, expanded enrollment sets, and adversarial hardening, which we designate as critical vectors for future research\.

### 6\.3Evaluation Limitations

Score\-level fusion successfully optimizes identification but degrades verification relative to standalone TF\-IDF \(EER=0\.421 vs\. 0\.381\)\. This divergence occurs because the two objectives require distinct topological representations: identification leverages complementary probability distributions, whereas verification demands the strict geometric separation of genuine and impostor embeddings\. TF\-IDF natively achieves this separation \(d′d^\{\\prime\}=0\.671\), but score mixing actively dilutes it \(dens′d^\{\\prime\}\_\{\\text\{ens\}\}=0\.471\)\. Future architectures could close this gap by applying triplet or contrastive loss directly to sparse, TF\-IDF\-inspired representations, optimizing both ranking and thresholding within a unified metric space\. Recent contrastive learning approaches for disentangling authorship from content\[[14](https://arxiv.org/html/2606.06755#bib.bib6)\],\[[23](https://arxiv.org/html/2606.06755#bib.bib30)\]suggest promising directions for such joint optimization

Biometric evaluation protocols recommend reporting True Accept Rates \(TAR\) at fixed operational thresholds\. Derived via ROC curve interpolation, our best\-performing TF\-IDF configuration yields TAR=16\.6%±\\pm4\.3% at FAR=1%, TAR=3\.4%±\\pm0\.9% at FAR=0\.1%, and TAR=2\.3%±\\pm1\.6% at FAR=0\.01%\.

## 7Conclusion

This work formalizes prompt\-based identity as a viable behavioral biometric, demonstrating that users leave a persistent, highly stable lexical fingerprint within their instrumental interactions with large language models\. Our evaluation confirms that a constrained 30,000\-feature lexical representation successfully isolates this identity signal, achieving 64\.2% Top\-1 accuracy across a 1,034\-user cohort outperforming random chance by a factor of 664\.

Through rigorous ablation, scalability testing, and adversarial localization, we conclusively map this identity fingerprint to the token\-surface layer rather than the semantic payload\. Because full semantic paraphrase effectively sanitizes the behavioral signal \(degrading Top\-1 accuracy to 0\.429 and driving EER to 0\.703\), it is evident that generative identity resides in the idiosyncrasies of surface phrasing, which semantic rewriting intrinsically destroys\. While score\-level fusion optimizes closed\-set identification, the sparse lexical component structurally dominates open\-set verification\.

Ultimately, demonstrating the stability of prompt as behavioral biometric highlights an important duality in the AI ecosystem\. On one hand, it can support new forms of low\-friction authentication and anomaly detection\. On the other hand, it also reveals a potential surveillance risk, as users may be unaware that routine prompts can act as digital identifiers\. By defining this threat model and releasing our evaluation protocols, we provide a foundation for future work in two directions: developing practical uses of prompt\-based identification and designing robust privacy\-preserving countermeasures\.

## References

- \[1\]\(2007\)A new biometric technology based on mouse dynamics\.IEEE Transactions on dependable and secure computing4\(3\),pp\. 165–179\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[2\]S\. Argamon, M\. Koppel, J\. W\. Pennebaker, and J\. Schler\(2007\)Mining the blogosphere: age, gender and the varieties of self\-expression\.First Monday\.Cited by:[§5\.2](https://arxiv.org/html/2606.06755#S5.SS2.p2.2)\.
- \[3\]S\. Bird, E\. Klein, and E\. Loper\(2009\)Natural language processing with python: analyzing text with the natural language toolkit\.” O’Reilly Media, Inc\.”\.Cited by:[§4\.1](https://arxiv.org/html/2606.06755#S4.SS1.p2.2)\.
- \[4\]N\. V\. Boulgouris, K\. N\. Plataniotis, and D\. Hatzinakos\(2006\)Gait recognition using linear time normalization\.Pattern Recognition39\(5\),pp\. 969–979\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[5\]N\. Carlini, F\. Tramer, E\. Wallace, M\. Jagielski, A\. Herbert\-Voss, K\. Lee, A\. Roberts, T\. Brown, D\. Song, U\. Erlingsson,et al\.\(2021\)Extracting training data from large language models\.In30th USENIX security symposium \(USENIX Security 21\),pp\. 2633–2650\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[6\]A\. Dantcheva, P\. Elia, and A\. Ross\(2015\)What else does your biometric data reveal? a survey on soft biometrics\.IEEE Transactions on Information Forensics and Security11\(3\),pp\. 441–467\.Cited by:[§5\.4](https://arxiv.org/html/2606.06755#S5.SS4.p1.1),[§6\.2](https://arxiv.org/html/2606.06755#S6.SS2.p1.1)\.
- \[7\]P\. Eckersley\(2010\)How unique is your web browser?\.InInternational Symposium on Privacy Enhancing Technologies Symposium,pp\. 1–18\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[8\]M\. Fabien, E\. Villatoro\-Tello, P\. Motlicek, and S\. Parida\(2020\)BertAA: bert fine\-tuning for authorship attribution\.InProceedings of the 17th International Conference on Natural Language Processing \(ICON\),pp\. 127–137\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[9\]R\. Fan, K\. Chang, C\. Hsieh, X\. Wang, and C\. Lin\(2008\)LIBLINEAR: a library for large linear classification\.the Journal of machine Learning research9,pp\. 1871–1874\.Cited by:[§4\.2](https://arxiv.org/html/2606.06755#S4.SS2.p7.1)\.
- \[10\]C\. Fellbaum\(1998\)WordNet: an electronic lexical database\.MIT press\.Cited by:[§4\.4](https://arxiv.org/html/2606.06755#S4.SS4.p1.3)\.
- \[11\]M\. Frank, R\. Biedert, E\. Ma, I\. Martinovic, and D\. Song\(2012\)Touchalytics: on the applicability of touchscreen input as a behavioral biometric for continuous authentication\.IEEE transactions on information forensics and security8\(1\),pp\. 136–148\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[12\]L\. Fridman, S\. Weber, R\. Greenstadt, and M\. Kam\(2016\)Active authentication on mobile devices via stylometry, application usage, web browsing, and gps location\.IEEE Systems Journal11\(2\),pp\. 513–521\.Cited by:[§6\.2](https://arxiv.org/html/2606.06755#S6.SS2.p1.1)\.
- \[13\]B\. Huang, C\. Chen, and K\. Shu\(2025\)Authorship attribution in the era of llms: problems\.Methodologies, and Challenges\. doi10\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[14\]J\. Huertas\-Tato, A\. Girón\-Jiménez, A\. Martín, and D\. Camacho\(2024\)Isolating authorship from content with semantic embeddings and contrastive learning\.arXiv preprint arXiv:2411\.18472\.Cited by:[§6\.3](https://arxiv.org/html/2606.06755#S6.SS3.p1.2)\.
- \[15\]M\. Koppel, J\. Schler, and S\. Argamon\(2011\)Authorship attribution in the wild\.Language Resources and Evaluation45\(1\),pp\. 83–94\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[16\]I\. Loshchilov and F\. Hutter\(2017\)Decoupled weight decay regularization\.arXiv preprint arXiv:1711\.05101\.Cited by:[§4\.2](https://arxiv.org/html/2606.06755#S4.SS2.p3.7)\.
- \[17\]K\. Luyckx and W\. Daelemans\(2011\)The effect of author set size and data size in authorship attribution\.Literary and linguistic Computing26\(1\),pp\. 35–55\.Cited by:[§5\.4](https://arxiv.org/html/2606.06755#S5.SS4.p1.1)\.
- \[18\]M\. McCloskey and N\. J\. Cohen\(1989\)Catastrophic interference in connectionist networks: the sequential learning problem\.InPsychology of learning and motivation,Vol\.24,pp\. 109–165\.Cited by:[§4\.2](https://arxiv.org/html/2606.06755#S4.SS2.p3.7)\.
- \[19\]F\. Monrose and A\. Rubin\(1997\)Authentication via keystroke dynamics\.InProceedings of the 4th ACM Conference on Computer and Communications Security,pp\. 48–56\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[20\]A\. Narayanan and V\. Shmatikov\(2008\)Robust de\-anonymization of large sparse datasets\.In2008 IEEE Symposium on Security and Privacy \(sp 2008\),pp\. 111–125\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[21\]F\. Perez and I\. Ribeiro\(2022\)Ignore previous prompt: attack techniques for language models\.arXiv preprint arXiv:2211\.09527\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[22\]S\. Raghavan, A\. Kovashka, and R\. Mooney\(2010\)Authorship attribution using probabilistic context\-free grammars\.InProceedings of the ACL 2010 conference short papers,pp\. 38–42\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[23\]R\. A\. Rivera\-Soto, O\. E\. Miano, J\. Ordonez, B\. Y\. Chen, A\. Khan, M\. Bishop, and N\. Andrews\(2021\)Learning universal authorship representations\.InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing,pp\. 913–919\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1),[§6\.3](https://arxiv.org/html/2606.06755#S6.SS3.p1.2)\.
- \[24\]J\. Roth, X\. Liu, and D\. Metaxas\(2014\)On continuous user authentication via typing behavior\.IEEE Transactions on Image Processing23\(10\),pp\. 4611–4624\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[25\]K\. Sparck Jones\(1972\)A statistical interpretation of term specificity and its application in retrieval\.Journal of documentation28\(1\),pp\. 11–21\.Cited by:[§4\.1](https://arxiv.org/html/2606.06755#S4.SS1.p2.2)\.
- \[26\]S\. Sprager and M\. B\. Juric\(2015\)Inertial sensor\-based gait recognition: a review\.Sensors15\(9\),pp\. 22089–22127\.Cited by:[§6\.2](https://arxiv.org/html/2606.06755#S6.SS2.p1.1)\.
- \[27\]R\. Staab, M\. Vero, M\. Balunović, and M\. Vechev\(2023\)Beyond memorization: violating privacy via inference with large language models\.arXiv preprint arXiv:2310\.07298\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.
- \[28\]E\. Stamatatos\(2009\)A survey of modern authorship attribution methods\.Journal of the American Society for information Science and Technology60\(3\),pp\. 538–556\.Cited by:[§1](https://arxiv.org/html/2606.06755#S1.p1.1),[§2](https://arxiv.org/html/2606.06755#S2.p1.1),[§4\.1](https://arxiv.org/html/2606.06755#S4.SS1.p2.2),[§4\.2](https://arxiv.org/html/2606.06755#S4.SS2.p7.1),[§5\.1](https://arxiv.org/html/2606.06755#S5.SS1.p4.1)\.
- \[29\]M\. Tschuggnall, B\. Murauer, and G\. Specht\(2019\)Reduce & attribute: two\-step authorship attribution for large\-scale problems\.InProceedings of the 23rd Conference on Computational Natural Language Learning \(CoNLL\),pp\. 951–960\.Cited by:[§5\.4](https://arxiv.org/html/2606.06755#S5.SS4.p1.1)\.
- \[30\]J\. Tyo, B\. Dhingra, and Z\. C\. Lipton\(2022\)On the state of the art in authorship attribution and authorship verification\.arXiv preprint arXiv:2209\.06869\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1),[§5\.1](https://arxiv.org/html/2606.06755#S5.SS1.p2.1)\.
- \[31\]L\. Wang, N\. Yang, X\. Huang, B\. Jiao, L\. Yang, D\. Jiang, R\. Majumder, and F\. Wei\(2022\)Text embeddings by weakly\-supervised contrastive pre\-training\.arXiv preprint arXiv:2212\.03533\.Cited by:[§4\.1](https://arxiv.org/html/2606.06755#S4.SS1.p2.2),[§5\.1](https://arxiv.org/html/2606.06755#S5.SS1.p2.1)\.
- \[32\]A\. Wegmann, M\. Schraagen, and D\. Nguyen\(2022\)Same author or just same topic? towards content\-independent style representations\.InProceedings of the 7th Workshop on Representation Learning for NLP,pp\. 249–268\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1),[§5\.1](https://arxiv.org/html/2606.06755#S5.SS1.p2.1)\.
- \[33\]J\. Zhang, Y\. Zhao, M\. Saleh, and P\. Liu\(2020\)Pegasus: pre\-training with extracted gap\-sentences for abstractive summarization\.InInternational conference on machine learning,pp\. 11328–11339\.Cited by:[§4\.4](https://arxiv.org/html/2606.06755#S4.SS4.p1.3)\.
- \[34\]W\. Zhao, X\. Ren, J\. Hessel, C\. Cardie, Y\. Choi, and Y\. Deng\(2024\)Wildchat: 1m chatgpt interaction logs in the wild\.arXiv preprint arXiv:2405\.01470\.Cited by:[§3](https://arxiv.org/html/2606.06755#S3.p1.1)\.
- \[35\]A\. Zou, Z\. Wang, N\. Carlini, M\. Nasr, J\. Z\. Kolter, and M\. Fredrikson\(2023\)Universal and transferable adversarial attacks on aligned language models\.arXiv preprint arXiv:2307\.15043\.Cited by:[§2](https://arxiv.org/html/2606.06755#S2.p1.1)\.